view mod_invites_tracking/README.md @ 5416:2393dbae51ed

mod_http_oauth2: Add option for specifying TTL of registered clients Meant to simplify configuration, since TTL vs ignoring expiration is expected to be the main thing one would want to configure. Unsure what the implications of having unlimited lifetime of clients are, given no way to revoke them currently, short of rotating the signing secret. On one hand, it would be annoying to have the client expire. On the other hand, it is trivial to re-register it.
author Kim Alvefur <zash@zash.se>
date Thu, 04 May 2023 18:41:33 +0200
parents 32f1f18f4874
children
line wrap: on
line source

---
labels:
- 'Stage-Alpha'
summary: 'Store who created the invite to create a user account'
...

Introduction
============

Invites are an intermediate way between opening registrations completely and
closing registrations completely.

By letting users invite other users to the server, an administrator exposes
themselves again to the risk of abuse.

To combat that abuse more effectively, this module allows to store (outside
of the user’s information) who created an invite which was used to create the
user’s account.

Details
=======

Add to `modules_enabled`.

Caveats
=======

- The information is not deleted even when the associated user accounts are
  deleted.
- Currently, there is no way to make any use of that information.